A self-described white-hat hacker withdrew roughly 4,000 bitcoin, valued at approximately $320 million to $340 million depending on the exact market price, from the Liquid Network federation wallet on September 6, 2026, then returned 3,400 bitcoin after the underlying software vulnerability was patched.
About 598.5 bitcoin, worth roughly $47 million, remains under the control of the unidentified party. Liquid Network, a Bitcoin sidechain developed by Blockstream and launched in 2018, has kept operations paused while federation members implement additional security improvements and prepare a coordinated restart.
The incident began around 14:05 UTC on September 6 when approximately 4,000 L-BTC tokens were submitted to the peg-out service operated by federation member SideSwap. The service processed the request through its normal authorization flow, burning the L-BTC and prompting the Liquid Federation to release about 3,996 bitcoin to a Bitcoin address roughly 23 minutes later.
SideSwap stated that neither its systems nor its Peg-out Authorization Key had been compromised. Blockstream later determined the L-BTC had been created through a bug in Elements, the open-source software that powers Liquid. The flaw involved range-proof verification caching related to Confidential Transactions and allowed the minting of tokens without corresponding bitcoin held in the federation reserves.
Prior to the withdrawal the federation wallet held around 4,200 bitcoin. After the transfer reserves fell to approximately 197 bitcoin, representing about 95 percent of the bitcoin backing L-BTC in circulation. Other assets issued on Liquid, including USDT, were unaffected.
The party controlling the withdrawn bitcoin embedded an on-chain message reading “we are whitehats. contact us on chain.” Liquid and Blockstream responded with on-chain messages and later shifted some communication to PGP-encrypted channels. The actors conditioned the return of most funds on confirmation that the bug had been fixed across all nodes.
Former Blockstream executive Samson Mow, now CEO of JAN3, posted public updates on the timeline. On September 7, Blockstream issued a PGP-signed on-chain message stating that bridge nodes had been patched and that it was safe to return the funds. Later that day, at approximately 16:09 UTC in Bitcoin block 965950, the party transferred 3,400 bitcoin back to the federation wallet address while retaining roughly 598.5 bitcoin.
Mow confirmed the return and noted that Blockstream continued to engage with the actors regarding the outstanding amount. Liquid Network and Blockstream have not publicly confirmed that the retained bitcoin constitutes an agreed bounty. Ledger Chief Technology Officer Charles Guillemet publicly questioned the white-hat designation, writing that retaining the remainder after a large withdrawal looked more like extortion than ethical disclosure.
Adam Back serves as CEO of Blockstream, the primary technology provider for Liquid. No private keys belonging to federation functionaries were reported compromised. An emergency Elements software update has been prepared, and federation members are resolving a related chain split before any restart.
As of September 9, 2026, Liquid Network bridge nodes remain disabled and L-BTC deposits and withdrawals stay suspended at participating exchanges. The identity of the party or parties behind the withdrawal has not been publicly disclosed.
